Bill would create bug bounty program inside DHS

The bill would create programs similar to initiatives at DOD and GSA.

A bipartisan group of senators has introduced a bill to create a bug bounty program inside the Department of Homeland Security.

Sens. Maggie Hassan, D-N.H., and Rob Portman, R-Ohio, introduced the Hack Department of Homeland Security Act, which would establish a bug bounty pilot program similar to ones in use at the Department of Defense and major tech companies around the world.

“Federal agencies like DHS are under assault every day from cyberattacks.  These attacks threaten the safety, security and privacy of millions of Americans and in order to protect DHS and the American people from these threats, the Department will need help,” Hassan said in a statement.

Bug bounty programs have started to catch on inside the government, buoyed by the Hack the Pentagon program that saw DOD issue $71,200 in bounties to hackers who found vulnerabilities are certain agency websites and systems. Since then, various military branches have created their own bounties. On the civilian side, the IRS and GSA have created similar programs. Outside vendors such as HackerOne and Synack typically have helped the government with such initiatives.

“The networks and systems at DHS are vital to our nation’s security.  It’s imperative that we take every step to protect DHS from the many cyber attacks they face every day,” said Portman.

The bill is also sponsored by Sens. Claire McCaskill, D-Mo., and Kamala Harris, D-Calif.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure